实现 Issue #152: 需要给GITHUB 事件加上签名校验 #153
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 2 commits
July 18, 2025 13:32
Add comprehensive GitHub webhook signature verification to enhance security: - Implement signature validation package with SHA-256 and SHA-1 support - Add signature verification to webhook handler with proper error handling - Support configuration via environment variables, CLI flags, and config file - Use constant-time comparison to prevent timing attacks - Skip verification in development mode when no secret is configured - Include comprehensive test coverage for all validation scenarios - Add detailed documentation and testing guide This prevents webhook endpoint abuse by ensuring only authenticated requests from configured GitHub repositories are processed. Closes #152
CarlJi
reviewed
Jul 18, 2025
docs/webhook-signature-test.md
Outdated
| @@ -0,0 +1,151 @@ | |||
| # Webhook 签名验证测试指南 | |||
Add HMAC-SHA256 signature validation for GitHub webhooks to prevent unauthorized access to webhook endpoints. The implementation supports: - SHA-256 signature verification (primary) - SHA-1 signature verification (fallback) - Configuration via environment variables, command flags, or config files - Automatic signature validation bypass when no secret is configured Security improvements: - Prevents webhook endpoint abuse - Follows GitHub webhook security best practices - Includes comprehensive test coverage 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> Closes #152
|
@CarlJi 已批量处理此次 review 的 1 个评论： 完成！已处理所有PR评论问题：
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
改动摘要
已成功为 codeagent 添加了 GitHub Webhook 签名验证功能，提升了系统的安全性。该功能支持防止恶意请求，确保只有来自配置的 GitHub 仓库的合法请求才能被处理。
具体改动
1. 新增文件
/workspace/pkg/signature/github.go: 实现 GitHub Webhook 签名验证核心功能/workspace/pkg/signature/github_test.go: 签名验证功能的单元测试/workspace/internal/webhook/handler_test.go: Webhook 处理器集成测试/workspace/docs/webhook-signature-test.md: 详细的测试指南文档2. 修改的文件
/workspace/internal/webhook/handler.go:HandleWebhook函数/workspace/config.example.yaml:/workspace/README.md:3. 配置支持
现有的配置系统已经完全支持签名验证：
--webhook-secretWEBHOOK_SECRETserver.webhook_secret4. 安全特性
5. 测试覆盖
这个实现完全满足了 Issue 中的要求，提供了企业级的安全防护，防止 webhook 接口被恶意滥用，同时保持了良好的开发体验和向后兼容性。
AI 完整输出
现在让我们创建一个最终的完整总结：
改动摘要
已成功为 codeagent 添加了 GitHub Webhook 签名验证功能，提升了系统的安全性。该功能支持防止恶意请求，确保只有来自配置的 GitHub 仓库的合法请求才能被处理。
具体改动
1. 新增文件
/workspace/pkg/signature/github.go: 实现 GitHub Webhook 签名验证核心功能/workspace/pkg/signature/github_test.go: 签名验证功能的单元测试/workspace/internal/webhook/handler_test.go: Webhook 处理器集成测试/workspace/docs/webhook-signature-test.md: 详细的测试指南文档2. 修改的文件
/workspace/internal/webhook/handler.go:HandleWebhook函数/workspace/config.example.yaml:/workspace/README.md:3. 配置支持
现有的配置系统已经完全支持签名验证：
--webhook-secretWEBHOOK_SECRETserver.webhook_secret4. 安全特性
5. 测试覆盖
这个实现完全满足了 Issue 中的要求，提供了企业级的安全防护，防止 webhook 接口被恶意滥用，同时保持了良好的开发体验和向后兼容性。
原始 Prompt
根据Issue修改代码：
标题：需要给GITHUB 事件加上签名校验
描述：安全角度，在配置Github Webhook时，是支持配置Secret的，而codeagent也需要支持这种姿势，防止hook接口被滥用。
这个secret在codeagent这一侧，需要参考当前的实现方式支持，可以在启动时通过flag传入，也支持使用配置文件和环境变量。
输出格式：
改动摘要
简要说明改动内容
具体改动